Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1fd519c1baa1e01…

MALICIOUS

PDF

42.6 KB Created: 2019-02-14 08:12:00 +03:00 Authoring application: Adobe InDesign CS3 (5.0.3) (via Adobe PDF Library 8.0)
MD5: 82f713dec610ad40ebe32ab56f37674b SHA-1: 5ff7c7361ee48c698fd9f8cb6933116d88671ec0 SHA-256: d1fd519c1baa1e0175934ea264891aff0d7155e153e42e60852aef2bd3447e0c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS classifier also flagged the document with high confidence. The primary attack pattern appears to be a link farm designed to manipulate search engine results or to distribute additional malicious content via the linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9027

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.gorillawalker.com/prelude-cadence-et-finale-for-alto-saxophone-and-piano.pdf
    • http://www.gorillawalker.com/u2-s-achtung-baby-meditations-on-love-in-the-shadow.pdf
    • http://www.gorillawalker.com/john-dalton-and-the-development-of-atomic-theory-profiles-in.pdf
    • http://www.gorillawalker.com/macular-degeneration-macular-regeneration-natural-vision-eye-care-book-3.pdf
    • http://www.gorillawalker.com/governance-for-development-in-africa-solving-collective-action-problems.pdf
    • http://www.gorillawalker.com/technical-issues-in-national-security-the-case-of-minuteman-vulnerability.pdf
    • http://www.gorillawalker.com/statistics-and-analysis-of-scientific-data-graduate-texts-in-physics.pdf
    • http://www.gorillawalker.com/the-cambridge-history-of-western-music-theory-the-cambridge-history.pdf
    • http://www.gorillawalker.com/sepilok-forest-preserving-sabah-s-natural-heritage.pdf
    • http://www.gorillawalker.com/physical-change-reshaping-matter-exploring-science-physical-science.pdf
    • http://www.gorillawalker.com/principles-and-practices-of-case-management-in-rehabilitation-counseling.pdf
    • http://www.gorillawalker.com/cruel-beauty-cruel-beauty-universe-book-1-kindle-edition.pdf
    • http://www.gorillawalker.com/an-early-wake-county-cork-series-book-3-kindle-edition.pdf
    • http://www.gorillawalker.com/fra-holberg-til-chr-richardt-en-litteratur-historie-i-biografier.pdf
    • http://www.gorillawalker.com/salads-innovative-main-courses-appetizers-desserts-and-more.pdf
    • http://www.gorillawalker.com/waffle-house-diaries.pdf
    • http://www.gorillawalker.com/compass-roses-and-directions-maps.pdf
    • http://www.gorillawalker.com/electrical-materials.pdf
    • http://www.gorillawalker.com/monica-seles-returning-champion-lerner-sports-achievers.pdf
    • http://www.gorillawalker.com/phronesis-and-quiddity-in-management-a-school-of-knowledge-approach.pdf
    • http://www.gorillawalker.com/the-oak-island-mystery-the-secret-of-the-world-s.pdf
    • http://www.gorillawalker.com/old-tippecanoe-william-henry-harrison-and-his-time.pdf
    • http://www.gorillawalker.com/thermodynamics-statistical-thermodynamics-kinetics-3rd-edition.pdf
    • http://www.gorillawalker.com/face-to-face-tiger-families-of-ranthambhore.pdf
    • http://www.gorillawalker.com/veterinary-epidemiology-an-introduction.pdf
    • http://www.gorillawalker.com/cardiology-an-illustrated-textbook-2-volume-set.pdf
    • http://www.gorillawalker.com/huge-hashi-mixed-grids-volume-1-159-puzzles.pdf
    • http://www.gorillawalker.com/painting-little-landscapes-hardcover.pdf
    • http://www.gorillawalker.com/the-duke-of-wellington-a-bibliography-bibliographies-of-british-statesmen.pdf
    • http://www.gorillawalker.com/the-great-sperm-whale-a-natural-history-of-the-ocean.pdf
    • http://www.gorillawalker.com/confusing-love-with-obsession-when-you-can-t-stop-controlling.pdf
    • http://www.gorillawalker.com/graphis-annual-reports-4-hardcover.pdf
    • http://www.gorillawalker.com/everybody-wins-the-chapman-guide-to-solving-conflicts-without-arguing.pdf
    • http://www.gorillawalker.com/at-the-entrance-to-the-garden-of-eden-a-jew.pdf
    • http://www.gorillawalker.com/ave-maria-ssa-from-dialogues-of-the-carmelites.pdf
    • http://www.gorillawalker.com/on-the-rocks-a-kizzie-baldwin-erotic-thriller-book-4.pdf
    • http://www.gorillawalker.com/structural-design-a-practical-guide-for-architects.pdf
    • http://www.gorillawalker.com/finding-the-way.pdf
    • http://www.gorillawalker.com/rca-linear-integrated-circuit-fundamentals-ts-ic-40.pdf
    • http://www.gorillawalker.com/economic-life-in-ottoman-jerusalem-cambridge-studies-in-islamic-civilization.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://www.aiim.org/pdfa/ns/extension/
    • http://www.aiim.org/pdfa/ns/schema#
    • http://www.aiim.org/pdfa/ns/property#
    • http://www.aiim.org/pdfa/ns/id/

Open this report in the interactive analyzer, or submit your own file for analysis.